Merge "Added fuzzer for libaaudio" (0f48f32a) · Commits · e / os / android_frameworks_av

media/libaaudio/fuzzer/Android.bp

0 → 100644

+63 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2021 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at:
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		cc_fuzz {
		name: "libaaudio_fuzzer",
		srcs: [
		"libaaudio_fuzzer.cpp",
		],
		header_libs: [
		"libaaudio_headers",
		],
		shared_libs: [
		"libbinder",
		"libaudiomanager",
		"libaudiopolicy",
		"libaudioclient_aidl_conversion",
		],
		static_libs: [
		"android.media.audio.common.types-V1-cpp",
		"liblog",
		"libutils",
		"libcutils",
		"libaaudio",
		"libjsoncpp",
		"libbase_ndk",
		"libcgrouprc",
		"libaudioutils",
		"libaudioclient",
		"aaudio-aidl-cpp",
		"libmedia_helper",
		"libmediametrics",
		"libprocessgroup",
		"av-types-aidl-cpp",
		"libaaudio_internal",
		"libcgrouprc_format",
		"audiopolicy-aidl-cpp",
		"audioflinger-aidl-cpp",
		"audiopolicy-types-aidl-cpp",
		"audioclient-types-aidl-cpp",
		"shared-file-region-aidl-cpp",
		"framework-permission-aidl-cpp",
		"mediametricsservice-aidl-cpp",
		],
		fuzz_config: {
		cc: [
		"android-media-fuzzing-reports@google.com",
		],
		componentid: 155276,
		},
		}

media/libaaudio/fuzzer/README.md

0 → 100644

+77 −0

Original line number	Diff line number	Diff line
		# Fuzzer for libaaudio

		## Plugin Design Considerations
		The fuzzer plugin for `libaaudio` are designed based on the understanding of the
		source code and tries to achieve the following:

		##### Maximize code coverage
		The configuration parameters are not hardcoded, but instead selected based on
		incoming data. This ensures more code paths are reached by the fuzzer.

		Fuzzers assigns values to the following parameters to pass on to libaaudio:
		1. Device Id (parameter name: `deviceId`)
		2. Sampling Rate (parameter name: `sampleRate`)
		3. Number of channels (parameter name: `channelCount`)
		4. Audio Travel Direction (parameter name: `direction`)
		5. Audio Format (parameter name: `format`)
		6. Audio Sharing Mode (parameter name: `sharingMode`)
		7. Audio Usage (parameter name: `usage`)
		8. Audio Content type (parameter name: `contentType`)
		9. Audio Input Preset (parameter name: `inputPreset`)
		10. Audio Privacy Sensitivity (parameter name: `privacySensitive`)
		11. Buffer Capacity In Frames (parameter name: `frames`)
		12. Performance Mode (parameter name: `mode`)
		13. Allowed Capture Policy (parameter name: `allowedCapturePolicy`)
		14. Session Id (parameter name: `sessionId`)
		15. Frames per Data Callback (parameter name: `framesPerDataCallback`)
		16. MMap Policy (parameter name: `policy`)

		\| Parameter\| Valid Values\| Configured Value\|
		\|------------- \|-------------\| ----- \|
		\| `deviceId` \| Any value of type `int32_t` \| Value obtained from FuzzedDataProvider \|
		\| `sampleRate` \| Any value of type `int32_t` \| Value obtained from FuzzedDataProvider \|
		\| `channelCount` \| Any value of type `int32_t` \| Value obtained from FuzzedDataProvider \|
		\| `direction` \| 0. `AAUDIO_DIRECTION_OUTPUT` 1. `AAUDIO_DIRECTION_INPUT` \| Value obtained from FuzzedDataProvider \|
		\| `format` \| 0. `AAUDIO_FORMAT_INVALID` 1. `AAUDIO_FORMAT_UNSPECIFIED` 2. `AAUDIO_FORMAT_PCM_I16` 3. `AAUDIO_FORMAT_PCM_FLOAT` \| Value obtained from FuzzedDataProvider \|
		\| `sharingMode` \| 0. `AAUDIO_SHARING_MODE_EXCLUSIVE` 1. `AAUDIO_SHARING_MODE_SHARED` \| Value obtained from FuzzedDataProvider \|
		\| `usage` \| 0. `AAUDIO_USAGE_MEDIA` 1. `AAUDIO_USAGE_VOICE_COMMUNICATION` 2. `AAUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING` 3. `AAUDIO_USAGE_ALARM` 4. `AAUDIO_USAGE_NOTIFICATION` 5. `AAUDIO_USAGE_NOTIFICATION_RINGTONE` 6. `AAUDIO_USAGE_NOTIFICATION_EVENT` 7. `AAUDIO_USAGE_ASSISTANCE_ACCESSIBILITY` 8. `AAUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE` 9. `AAUDIO_USAGE_ASSISTANCE_SONIFICATION` 10. `AAUDIO_USAGE_GAME` 11. `AAUDIO_USAGE_ASSISTANT` 12. `AAUDIO_SYSTEM_USAGE_EMERGENCY` 13. `AAUDIO_SYSTEM_USAGE_SAFETY` 14. `AAUDIO_SYSTEM_USAGE_VEHICLE_STATUS` 15. `AAUDIO_SYSTEM_USAGE_ANNOUNCEMENT` \| Value obtained from FuzzedDataProvider \|
		\| `contentType` \| 0. `AAUDIO_CONTENT_TYPE_SPEECH` 1. `AAUDIO_CONTENT_TYPE_MUSIC` 2. `AAUDIO_CONTENT_TYPE_MOVIE` 3. `AAUDIO_CONTENT_TYPE_SONIFICATION` \| Value obtained from FuzzedDataProvider \|
		\| `inputPreset` \| 0. `AAUDIO_INPUT_PRESET_GENERIC` 1. `AAUDIO_INPUT_PRESET_CAMCORDER` 2. `AAUDIO_INPUT_PRESET_VOICE_RECOGNITION` 3. `AAUDIO_INPUT_PRESET_VOICE_COMMUNICATION` 4. `AAUDIO_INPUT_PRESET_UNPROCESSED` 5. `AAUDIO_INPUT_PRESET_VOICE_PERFORMANCE` \| Value obtained from FuzzedDataProvider \|
		\| `privacySensitive` \| 0. `true` 1. `false` \| Value obtained from FuzzedDataProvider \|
		\| `frames` \| Any value of type `int32_t` \| Value obtained from FuzzedDataProvider \|
		\| `mode` \| 0. `AAUDIO_PERFORMANCE_MODE_NONE` 1. `AAUDIO_PERFORMANCE_MODE_POWER_SAVING` 2. `AAUDIO_PERFORMANCE_MODE_LOW_LATENCY` \| Value obtained from FuzzedDataProvider \|
		\| `allowedCapturePolicy` \| 0. `AAUDIO_ALLOW_CAPTURE_BY_ALL` 1. `AAUDIO_ALLOW_CAPTURE_BY_SYSTEM` 2. `AAUDIO_ALLOW_CAPTURE_BY_NONE` \| Value obtained from FuzzedDataProvider \|
		\| `sessionId` \| 0. `AAUDIO_SESSION_ID_NONE` 1. `AAUDIO_SESSION_ID_ALLOCATE` \| Value obtained from FuzzedDataProvider \|
		\| `framesPerDataCallback` \| Any value of type `int32_t` \| Value obtained from FuzzedDataProvider \|
		\| `policy` \| 0. `AAUDIO_POLICY_NEVER` 1. `AAUDIO_POLICY_AUTO` 2. `AAUDIO_POLICY_ALWAYS` \| Value obtained from FuzzedDataProvider \|

		This also ensures that the plugin is always deterministic for any given input.

		##### Maximize utilization of input data
		The plugin feed the entire input data to the module.
		This ensures that the plugins tolerates any kind of input (empty, huge,
		malformed, etc) and doesn't `exit()` on any input and thereby increasing the
		chance of identifying vulnerabilities.

		## Build

		This describes steps to build libaaudio_fuzzer binary.

		### Android

		#### Steps to build
		Build the fuzzer
		```
		$ mm -j$(nproc) libaaudio_fuzzer
		```
		### Steps to run

		To run on device
		```
		$ adb sync data
		$ adb shell /data/fuzz/arm64/libaaudio_fuzzer/libaaudio_fuzzer
		```

		## References:
		* http://llvm.org/docs/LibFuzzer.html
		* https://github.com/google/oss-fuzz

media/libaaudio/fuzzer/libaaudio_fuzzer.cpp

0 → 100644

+289 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2021 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at:
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*
		*/

		#include "aaudio/AAudio.h"
		#include "aaudio/AAudioTesting.h"
		#include <fuzzer/FuzzedDataProvider.h>

		constexpr int32_t kRandomStringLength = 256;

		constexpr int64_t kNanosPerMillisecond = 1000 * 1000;

		constexpr aaudio_direction_t kDirections[] = {
		AAUDIO_DIRECTION_OUTPUT, AAUDIO_DIRECTION_INPUT, AAUDIO_UNSPECIFIED};

		constexpr aaudio_performance_mode_t kPerformanceModes[] = {
		AAUDIO_PERFORMANCE_MODE_NONE, AAUDIO_PERFORMANCE_MODE_POWER_SAVING,
		AAUDIO_PERFORMANCE_MODE_LOW_LATENCY, AAUDIO_UNSPECIFIED};

		constexpr aaudio_format_t kFormats[] = {
		AAUDIO_FORMAT_INVALID, AAUDIO_FORMAT_UNSPECIFIED,
		AAUDIO_FORMAT_PCM_I16, AAUDIO_FORMAT_PCM_FLOAT,
		AAUDIO_FORMAT_PCM_I24_PACKED, AAUDIO_FORMAT_PCM_I32};

		constexpr aaudio_sharing_mode_t kSharingModes[] = {
		AAUDIO_SHARING_MODE_EXCLUSIVE, AAUDIO_SHARING_MODE_SHARED};

		constexpr int32_t kSampleRates[] = {AAUDIO_UNSPECIFIED,
		8000,
		11025,
		16000,
		22050,
		32000,
		44100,
		48000,
		88200,
		96000};

		constexpr aaudio_usage_t kUsages[] = {
		AAUDIO_USAGE_MEDIA,
		AAUDIO_USAGE_VOICE_COMMUNICATION,
		AAUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING,
		AAUDIO_USAGE_ALARM,
		AAUDIO_USAGE_NOTIFICATION,
		AAUDIO_USAGE_NOTIFICATION_RINGTONE,
		AAUDIO_USAGE_NOTIFICATION_EVENT,
		AAUDIO_USAGE_ASSISTANCE_ACCESSIBILITY,
		AAUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE,
		AAUDIO_USAGE_ASSISTANCE_SONIFICATION,
		AAUDIO_USAGE_GAME,
		AAUDIO_USAGE_ASSISTANT,
		AAUDIO_SYSTEM_USAGE_EMERGENCY,
		AAUDIO_SYSTEM_USAGE_SAFETY,
		AAUDIO_SYSTEM_USAGE_VEHICLE_STATUS,
		AAUDIO_SYSTEM_USAGE_ANNOUNCEMENT,
		AAUDIO_UNSPECIFIED};

		constexpr aaudio_content_type_t kContentTypes[] = {
		AAUDIO_CONTENT_TYPE_SPEECH, AAUDIO_CONTENT_TYPE_MUSIC,
		AAUDIO_CONTENT_TYPE_MOVIE, AAUDIO_CONTENT_TYPE_SONIFICATION,
		AAUDIO_UNSPECIFIED};

		constexpr aaudio_input_preset_t kInputPresets[] = {
		AAUDIO_INPUT_PRESET_GENERIC,
		AAUDIO_INPUT_PRESET_CAMCORDER,
		AAUDIO_INPUT_PRESET_VOICE_RECOGNITION,
		AAUDIO_INPUT_PRESET_VOICE_COMMUNICATION,
		AAUDIO_INPUT_PRESET_UNPROCESSED,
		AAUDIO_INPUT_PRESET_VOICE_PERFORMANCE,
		AAUDIO_UNSPECIFIED};

		constexpr aaudio_allowed_capture_policy_t kAllowedCapturePolicies[] = {
		AAUDIO_ALLOW_CAPTURE_BY_ALL, AAUDIO_ALLOW_CAPTURE_BY_SYSTEM,
		AAUDIO_ALLOW_CAPTURE_BY_NONE, AAUDIO_UNSPECIFIED};

		constexpr aaudio_session_id_t kSessionIds[] = {
		AAUDIO_SESSION_ID_NONE, AAUDIO_SESSION_ID_ALLOCATE, AAUDIO_UNSPECIFIED};

		constexpr aaudio_policy_t kPolicies[] = {
		AAUDIO_POLICY_NEVER, AAUDIO_POLICY_AUTO, AAUDIO_POLICY_ALWAYS,
		AAUDIO_UNSPECIFIED};

		class LibAaudioFuzzer {
		public:
		~LibAaudioFuzzer() { deInit(); }
		bool init();
		void process(const uint8_t *data, size_t size);
		void deInit();

		private:
		AAudioStreamBuilder *mAaudioBuilder = nullptr;
		AAudioStream *mAaudioStream = nullptr;
		};

		bool LibAaudioFuzzer::init() {
		aaudio_result_t result = AAudio_createStreamBuilder(&mAaudioBuilder);
		if ((result != AAUDIO_OK) \|\| (!mAaudioBuilder)) {
		return false;
		}
		return true;
		}

		void LibAaudioFuzzer::process(const uint8_t *data, size_t size) {
		FuzzedDataProvider fdp(data, size);
		aaudio_performance_mode_t mode =
		fdp.PickValueInArray({fdp.PickValueInArray(kPerformanceModes),
		fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setPerformanceMode(mAaudioBuilder, mode);

		int32_t deviceId = fdp.PickValueInArray(
		{AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setDeviceId(mAaudioBuilder, deviceId);

		std::string packageName = fdp.PickValueInArray<std::string>(
		{"android.nativemedia.aaudio", "android.app.appops.cts",
		fdp.ConsumeRandomLengthString(kRandomStringLength)});
		AAudioStreamBuilder_setPackageName(mAaudioBuilder, packageName.c_str());

		std::string attributionTag =
		fdp.ConsumeRandomLengthString(kRandomStringLength);
		AAudioStreamBuilder_setAttributionTag(mAaudioBuilder, attributionTag.c_str());

		int32_t sampleRate = fdp.PickValueInArray(kSampleRates);
		AAudioStreamBuilder_setSampleRate(mAaudioBuilder, sampleRate);

		int32_t channelCount = fdp.PickValueInArray(
		{AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setChannelCount(mAaudioBuilder, channelCount);

		aaudio_direction_t direction = fdp.PickValueInArray(
		{fdp.PickValueInArray(kDirections), fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setDirection(mAaudioBuilder, direction);

		aaudio_format_t format = fdp.PickValueInArray(
		{fdp.PickValueInArray(kFormats), fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setFormat(mAaudioBuilder, format);

		aaudio_sharing_mode_t sharingMode = fdp.PickValueInArray(
		{fdp.PickValueInArray(kSharingModes), fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setSharingMode(mAaudioBuilder, sharingMode);

		aaudio_usage_t usage = fdp.PickValueInArray(
		{fdp.PickValueInArray(kUsages), fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setUsage(mAaudioBuilder, usage);

		aaudio_content_type_t contentType = fdp.PickValueInArray(
		{fdp.PickValueInArray(kContentTypes), fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setContentType(mAaudioBuilder, contentType);

		aaudio_input_preset_t inputPreset = fdp.PickValueInArray(
		{fdp.PickValueInArray(kInputPresets), fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setInputPreset(mAaudioBuilder, inputPreset);

		bool privacySensitive = fdp.ConsumeBool();
		AAudioStreamBuilder_setPrivacySensitive(mAaudioBuilder, privacySensitive);

		int32_t frames = fdp.PickValueInArray(
		{AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setBufferCapacityInFrames(mAaudioBuilder, frames);

		aaudio_allowed_capture_policy_t allowedCapturePolicy =
		fdp.PickValueInArray({fdp.PickValueInArray(kAllowedCapturePolicies),
		fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setAllowedCapturePolicy(mAaudioBuilder,
		allowedCapturePolicy);

		aaudio_session_id_t sessionId = fdp.PickValueInArray(
		{fdp.PickValueInArray(kSessionIds), fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setSessionId(mAaudioBuilder, sessionId);

		AAudioStreamBuilder_setDataCallback(mAaudioBuilder, nullptr, nullptr);
		AAudioStreamBuilder_setErrorCallback(mAaudioBuilder, nullptr, nullptr);

		int32_t framesPerDataCallback = fdp.PickValueInArray(
		{AAUDIO_UNSPECIFIED, fdp.ConsumeIntegral<int32_t>()});
		AAudioStreamBuilder_setFramesPerDataCallback(mAaudioBuilder,
		framesPerDataCallback);

		aaudio_policy_t policy = fdp.PickValueInArray(
		{fdp.PickValueInArray(kPolicies), fdp.ConsumeIntegral<int32_t>()});
		AAudio_setMMapPolicy(policy);
		(void)AAudio_getMMapPolicy();

		aaudio_result_t result =
		AAudioStreamBuilder_openStream(mAaudioBuilder, &mAaudioStream);
		if ((result != AAUDIO_OK) \|\| (!mAaudioStream)) {
		return;
		}

		int32_t framesPerBurst = AAudioStream_getFramesPerBurst(mAaudioStream);
		uint8_t numberOfBursts = fdp.ConsumeIntegral<uint8_t>();
		int32_t maxInputFrames = numberOfBursts * framesPerBurst;
		int32_t requestedBufferSize =
		fdp.ConsumeIntegral<uint16_t>() * framesPerBurst;
		AAudioStream_setBufferSizeInFrames(mAaudioStream, requestedBufferSize);

		int64_t position = 0, nanoseconds = 0;
		AAudioStream_getTimestamp(mAaudioStream, CLOCK_MONOTONIC, &position,
		&nanoseconds);

		AAudioStream_requestStart(mAaudioStream);

		aaudio_format_t actualFormat = AAudioStream_getFormat(mAaudioStream);
		int32_t actualChannelCount = AAudioStream_getChannelCount(mAaudioStream);

		int32_t count = fdp.ConsumeIntegral<int32_t>();
		direction = AAudioStream_getDirection(mAaudioStream);
		framesPerDataCallback = AAudioStream_getFramesPerDataCallback(mAaudioStream);

		if (actualFormat == AAUDIO_FORMAT_PCM_I16) {
		std::vector<int16_t> inputShortData(maxInputFrames * actualChannelCount,
		0x0);
		if (direction == AAUDIO_DIRECTION_INPUT) {
		AAudioStream_read(mAaudioStream, inputShortData.data(),
		framesPerDataCallback, count * kNanosPerMillisecond);
		} else if (direction == AAUDIO_DIRECTION_OUTPUT) {
		AAudioStream_write(mAaudioStream, inputShortData.data(),
		framesPerDataCallback, count * kNanosPerMillisecond);
		}
		} else if (actualFormat == AAUDIO_FORMAT_PCM_FLOAT) {
		std::vector<float> inputFloatData(maxInputFrames * actualChannelCount, 0x0);
		if (direction == AAUDIO_DIRECTION_INPUT) {
		AAudioStream_read(mAaudioStream, inputFloatData.data(),
		framesPerDataCallback, count * kNanosPerMillisecond);
		} else if (direction == AAUDIO_DIRECTION_OUTPUT) {
		AAudioStream_write(mAaudioStream, inputFloatData.data(),
		framesPerDataCallback, count * kNanosPerMillisecond);
		}
		}

		aaudio_stream_state_t state = AAUDIO_STREAM_STATE_UNKNOWN;
		AAudioStream_waitForStateChange(mAaudioStream, AAUDIO_STREAM_STATE_UNKNOWN,
		&state, count * kNanosPerMillisecond);
		(void)AAudio_convertStreamStateToText(state);

		(void)AAudioStream_getUsage(mAaudioStream);
		(void)AAudioStream_getSampleRate(mAaudioStream);
		(void)AAudioStream_getState(mAaudioStream);
		(void)AAudioStream_getSamplesPerFrame(mAaudioStream);
		(void)AAudioStream_getContentType(mAaudioStream);
		(void)AAudioStream_getInputPreset(mAaudioStream);
		(void)AAudioStream_isPrivacySensitive(mAaudioStream);
		(void)AAudioStream_getAllowedCapturePolicy(mAaudioStream);
		(void)AAudioStream_getPerformanceMode(mAaudioStream);
		(void)AAudioStream_getDeviceId(mAaudioStream);
		(void)AAudioStream_getSharingMode(mAaudioStream);
		(void)AAudioStream_getSessionId(mAaudioStream);
		(void)AAudioStream_getFramesRead(mAaudioStream);
		(void)AAudioStream_getFramesWritten(mAaudioStream);
		(void)AAudioStream_getXRunCount(mAaudioStream);
		(void)AAudioStream_getBufferCapacityInFrames(mAaudioStream);
		(void)AAudioStream_getBufferSizeInFrames(mAaudioStream);
		(void)AAudioStream_isMMapUsed(mAaudioStream);

		AAudioStream_requestPause(mAaudioStream);
		AAudioStream_requestFlush(mAaudioStream);
		AAudioStream_release(mAaudioStream);
		AAudioStream_requestStop(mAaudioStream);
		}

		void LibAaudioFuzzer::deInit() {
		if (mAaudioBuilder) {
		AAudioStreamBuilder_delete(mAaudioBuilder);
		}
		if (mAaudioStream) {
		AAudioStream_close(mAaudioStream);
		}
		}

		extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
		LibAaudioFuzzer libAaudioFuzzer;
		if (libAaudioFuzzer.init()) {
		libAaudioFuzzer.process(data, size);
		}
		return 0;
		}